Question

What is the data structure of C++ class?
how it works in assembly level?

IF statement is the compare + conditional jump of code line.

Array and string is the chain link of datas.

Answer 1

The compiler assigns offsets to all members, and includes these in all load/store operations on members:

struct foo {
    uint32_t bar;
    uint32_t baz;

    uint32_t get_baz() { return baz; }
};

uint32_t get_baz_from_foo(foo *f) { return f->baz; }

becomes (ARM assembler code used for simplicity):

foo__get_baz:
    ; calling convention: this pointer in r3
    ; load 32 bit value from r3 + 4 bytes into r0
    ldr r0, [r3, #4];
    ; calling convention: return value in r0
    ; return from subroutine
    b lr

get_baz_from_foo:
    ; calling convention: first parameter in r0
    ; load 32 bit value from r0 + 4 bytes into r0
    ldr r0, [r0, #4]
    ; calling convention: return value in r0
    ; return from subroutine
    b lr

As struct respective class layout does not change after compilation, the 4 is hardcoded into the instruction stream here.

Creating an instance works by allocating memory, and passing the pointer from the allocation function to everyone expecting a pointer to the struct:

new__foo:
    ; two 32 bit integers need 8 bytes
    ; calling convention: first parameter in r0
    mov r0, #8
    ; call allocator, which will then return to the function invoking new
    bra malloc

If there is a constructor

struct foo2 {
    foo2() : bar(5), baz(7) { }
    uint32_t bar;
    uint32_t baz;
    uint32_t get_baz() { return baz; }
};

We end up with a slightly more complicated way to create objects (which you should be able to figure out without comments):

new__foo2:
    strdb lr, ![sp]
    mov r0, #8
    bl malloc
    mov r1, #5
    str r1, [r0]
    mov r1, #7
    str r1, [r0, #4]
    ldaia lr, ![sp]
    b lr

The get_baz implementation is the same as for the foo class.

Now if I construct such an object and get the baz value:

    bl new__foo2
    ; remember: the this pointer goes to r3
    mov r3, r0
    bl foo2__get_baz

I end up with r0 containing the value 7.

For virtual methods, a hidden data member is created, which is a pointer to a table of functions:

struct base {
    virtual uint32_t get_baz() = 0;
};

struct derived : base {
    derived() : baz(5) { }
    virtual uint32_t get_baz();
    uint32_t bar;
    uint32_t baz;
};

becomes

new__derived:
    strdb lr, ![sp]
    mov r0, #12
    bl malloc
    mov r1, #5
    str r1, [r0, #8]
    ; get the address of the vtable
    ldr r1, =vtable__derived
    ; vtable typically goes to the end of the class defining it
    ; as this is the base class, it goes before derived's data members
    str r1, [r0]
    ldria lr, ![sp]
    b lr

vtable__derived:
    ; pointer to function
    dw derived__get_baz

derived__get_baz:
    ldr r0, [r3, #8]
    b lr

Calling this function is done indirectly:

    ; construct normally
    bl new__derived
    ; here, we forget that this is a "derived" object
    ; this pointer to r3
    mov r3, r0
    ; get vtable ptr
    ldr r0, [r3]
    ; get function ptr from vtable
    ldr r0, [r0]
    ; call function
    bl r0

Here, r0 is now 5, because that is what the constructor stored there.